Track user login status

Hi folks
Can you help me to find, if I can track any user login status via AD server. Say if a, user has local account on a desktop or laptop, and he cracks the admin password and logins himself as administrator or puts himself in admin group, how to track remotely. Pls. give me complete procedure.